python-cryptography (43.0.0-1ubuntu1.2) questing-security; urgency=medium

  * SECURITY REGRESSION: ecc support regression (LP: #2144373)
    - debian/patches/CVE-2026-26007.patch: updated to remove problematic
      deprecation warning code which is causing a regression with ansible.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 14 Mar 2026 08:14:57 -0400

python-cryptography (43.0.0-1ubuntu1.1) questing-security; urgency=medium

  * SECURITY UPDATE: Subgroup Attack Due to Missing Subgroup Validation for
    SECT Curves
    - debian/patches/CVE-2026-26007.patch: EC check key on cofactor > 1 in
      src/cryptography/hazmat/primitives/asymmetric/ec.py,
      src/cryptography/utils.py, src/rust/src/backend/ec.rs,
      tests/hazmat/primitives/test_ec.py.
    - CVE-2026-26007

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 20 Feb 2026 08:22:42 -0500

python-cryptography (43.0.0-1ubuntu1) plucky; urgency=medium

  * Add a recipe in d/rules to generate the vendor tarball
  * Add vendored crates
  * Provide an empty cargo-checksum.json
  * Don't downgrade deps in rust lockfile
  * Don't generate lockfile during configure
  * Remove vcpkg from lockfile
  * Don't depend on rust -dev distribution packages
  * Depend on dh-cargo, dh-cargo-tools, pkgconf and setuptools
  * Configure for cargo

 -- Adrien Nader <adrien.nader@canonical.com>  Thu, 27 Mar 2025 15:43:53 +0100

python-cryptography (43.0.0-1) unstable; urgency=medium

  * New upstream version.
  * Update and rearrange Build-Depends:
    + Removed:
      - librust-asn1-derive-0.15-dev (obsolete)
      - librust-ouroboros-0.15-dev (obsolete)
      - librust-paste-dev (obsolete)
      - librust-pyo3-macros-0.20-dev (not an explicit dep)
      - python3-hypothesis (obsolete)
      - python3-iso8601 (obsolete)
      - python3-pytest-subtests (obsolete)
      - python3-setuptools (changed in this version)
      - python3-setuptools-rust (changed in this version)
      - python3-tz (obsolete)
      - tzdata (obsolete)
    + Added:
      - librust-cc-1.1-dev (forgotten explicit dep)
      - librust-foreign-types-0.3-dev (forgotten explicit dep)
      - python3-bcrypt (optional dep)
      - python3-certifi (forgotten explicit dep; fixes building with nodoc)
      - python3-maturin (changed in this version)
    + Moved to Build-Depends-Indep:
      - dh-sequence-sphinxdoc
      - python3-doc
      - python3-sphinx
      - python3-sphinx-rtd-theme
    + Version updates (Closes: #1080395):
      - librust-asn1-0.17-dev (from 0.15)
      - librust-pyo3-0.22-dev (from 0.20)
      - librust-pyo3-0.22+default-dev (from 0.20)
  * Change upstream version reqs to ones provided by Debian:
    + asn1 0.16.2 -> 0.17.0
    + openssl 0.10.65 -> 0.10.63
    + openssl-sys 0.9.103 -> 0.9.101
  * Skip tests that fail with librust-openssl-dev < 0.10.65.
  * Add python3-bcrypt to Depends.
  * Move documentation build-deps into Build-Depends-Indep.
  * Bump Standards-Version to 4.7.0.

 -- Andrey Rakhmatullin <wrar@debian.org>  Tue, 10 Sep 2024 23:55:34 +0500

python-cryptography (42.0.5-2) unstable; urgency=medium

  * Patch: upstream fix for 32-bit archs tests

 -- Jérémy Lal <kapouer@melix.org>  Tue, 19 Mar 2024 23:15:50 +0100

python-cryptography (42.0.5-1) unstable; urgency=medium

  * Team upload.
  * Bump setuptools-rust, rust-pem, rust-openssl, rust-openssl-sys deps
  * Testsuite: autopkgtest-pkg-pybuild

  [ Andreas Tille ]
  * New upstream version
    Closes: #1059308 (CVE-2023-50782)
    Closes: #1064778 (CVE-2024-26130)
    Closes: #1063771, #1018159
  * watch file standard 4 (routine-update)
    Closes: #1046569
 
  [ Michael R. Crusoe ]
  * Reorder sequence of d/control fields by cme (routine-update)
  * d/{tests/,}control: update dependency on python3-cryptography-vectors
  * marked intersphinx patch as not needing forwarding

  [ Andrey Rakhmatullin ]
  * Add myself to Uploaders.

  [ Jérémy Lal ]
  * Testsuite: autopkgtest-pkg-pybuild

 -- Jérémy Lal <kapouer@melix.org>  Tue, 19 Mar 2024 10:58:04 +0100

python-cryptography (41.0.7-5) unstable; urgency=medium

  * AMAU, Closes: #1064979

  [ Andreas Tille ]
  * Enable building twice in a row

 -- Jérémy Lal <kapouer@melix.org>  Thu, 07 Mar 2024 13:42:35 +0100

python-cryptography (41.0.7-4) unstable; urgency=medium

  * orphan

 -- Sandro Tosi <morph@debian.org>  Wed, 28 Feb 2024 12:23:58 -0500

python-cryptography (41.0.7-3) unstable; urgency=medium

  * Upgrade to pyo3 0.20. Closes: #1063365

 -- Jérémy Lal <kapouer@melix.org>  Thu, 08 Feb 2024 15:34:30 +0100

python-cryptography (41.0.7-2) unstable; urgency=medium

  * patch: drop pem 1.0 workaround, depends pem 1.1. Closes: 1060294.
  * autopkgtest: fix version of cryptography-vectors

 -- Jérémy Lal <kapouer@melix.org>  Tue, 09 Jan 2024 01:14:48 +0100

python-cryptography (41.0.7-1) unstable; urgency=medium

  * Team upload
  * New upstream version 41.0.7
  * patch: remove n/a, disable a test to keep building with pem 1.0
  * Update deps
  * Bump Standards-Version

  [ Sandro Tosi ]
  * New upstream release; Closes: #1031049
    - fixes CVE-2023-23931
  * debian/watch
    - remove pgpsigurlmangle, .asc file no longer on PyPI

  [ Nicolas Dandrimont ]
  * New upstream version 41.0.3

 -- Jérémy Lal <kapouer@melix.org>  Sun, 07 Jan 2024 13:24:39 +0100

python-cryptography (38.0.4-4) unstable; urgency=medium

  * Team Upload.

  [ Peter Michael Green ]
  * Don't depend on librust-indoc-dev, it's not used directly,
    instead depend on the "default" feature of librust-pyo3-dev.
  * Apply adjusted upstream patch for py03 0.19 and bump
    dependencies accordingly (Closes: #1038746, #1042160)

  [ Nicolas Dandrimont ]
  * Fix tests when using recent tzdata (dropping the US timezone
    symlinks)

 -- Nicolas Dandrimont <olasd@debian.org>  Tue, 08 Aug 2023 17:16:11 +0200

python-cryptography (38.0.4-3) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * Don't allow update_into to mutate immutable objects (CVE-2023-23931)
    (Closes: #1031049)

 -- Sandro Tosi <morph@debian.org>  Tue, 28 Feb 2023 00:36:13 -0500

python-cryptography (38.0.4-2) unstable; urgency=medium

  * Team upload.
  * Patch: Remove the runtime dependency on cffi from .dist-info.
    (Closes: #1026537)

 -- Stefano Rivera <stefanor@debian.org>  Sun, 08 Jan 2023 16:31:04 -0400

python-cryptography (38.0.4-1) unstable; urgency=medium

  [ Claudius Heine ]
  * New upstream release (Closes: #1011155).
  * Dropped openssl3 patches, no longer required.
  * Integrated build of embedded rust library.
  * debian/control
    - bump b-d on cryptography-vectors to 38.0.4
    - build using pybuild-plugin-pyproject
    - remove dependencies dropped by upstream
    - add pytest-benchmark to b-d, needed for tests
    - add setuptools-rust to b-d, needed for the Rust part of the build
    - add cargo and other rust pkgs to b-d
    - bump Standards-Version to 4.6.1 (no changes needed)
  * debian/pydist-overrides, debian/py3dist-overrides
    - remove dependencies dropped by upstream
  * debian/rules
    - enable the Rust build
    - override dh_dwz to disable multifile
  * debian/patches/no-rust.patch
    - removed, we are actually building the Rust code now
  * debian/python-cryptography-doc.doc-base
    - add doc-base
  * debian/source/options
    - exclude some packaging files updated during build
  * debian/patches/Upgrade-to-pyo3-0.*
    - add support for pyo3 0.16 and 0.17
  * debian/patches/allow-pem-version-1.0.patch
    - relax pem rust versioned dependency
  * debian/patches/ease-asn1-version-from-0.12.1-to-0.12.patch
    - relax asn1 rust versioned dependency
  * debian/patches/ease-chrono-dependency-from-0.4.22-to-0.4.patch
    - relax chrono rust versioned dependency

  [ Sandro Tosi ]
  * debian/control
    - run wrap-and-sort

 -- Sandro Tosi <morph@debian.org>  Thu, 15 Dec 2022 12:00:09 -0500

python-cryptography (3.4.8-3) UNRELEASED; urgency=medium

  * Remove constraints unnecessary since buster:
    + Build-Depends: Drop versioned constraint on dpkg-dev, python3-asn1crypto,
      python3-cffi, python3-idna, python3-pytest, python3-setuptools and
      python3-six.
    + python3-cryptography: Drop versioned constraint on python3-openssl in
      Breaks.

 -- Debian Janitor <janitor@jelmer.uk>  Thu, 19 May 2022 05:05:36 -0000

python-cryptography (3.4.8-2) unstable; urgency=medium

  * Team upload.
  * Add support for OpenSSL 3.0.1 (Closes: #1006008)

 -- Stefano Rivera <stefanor@debian.org>  Wed, 18 May 2022 12:22:15 -0400

python-cryptography (3.4.8-1) unstable; urgency=medium

  [ Simon Chopin ]
  * New upstream release.
    - Closes: #995431
  * d/p/no_rust.patch, d/control: Disable the Rust part of the build
    since it's not yet mandatory
  * d/control, d/tests/control: new build-dependency on python-pytest-subtests
    for the testsuite
  * d/p/openssl3/*: Cherry-pick a patchset for OpenSSL3 compatibility.
    - LP: #1946189

  [ Tristan Seligmann ]
  * Update standards version to 4.6.0, no changes needed.
  * Fix Python dir glob for 3.10.

 -- Tristan Seligmann <mithrandi@debian.org>  Wed, 01 Dec 2021 17:54:50 +0200

python-cryptography (3.3.2-1) unstable; urgency=high

  * New upstream release.
    - Fixes CVE-2020-36242.

 -- Tristan Seligmann <mithrandi@debian.org>  Wed, 10 Feb 2021 10:15:26 +0200

python-cryptography (3.3.1-1) unstable; urgency=medium

  [ Sandro Tosi ]
  * Use the new Debian Python Team contact name and address

  [ Tristan Seligmann ]
  * New upstream release.

 -- Tristan Seligmann <mithrandi@debian.org>  Tue, 26 Jan 2021 10:05:25 +0200

python-cryptography (3.2.1-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Tristan Seligmann ]
  * New upstream release.
    - Closes: #973247 (CVE-2020-25659)

 -- Tristan Seligmann <mithrandi@debian.org>  Sun, 01 Nov 2020 15:22:43 +0200

python-cryptography (3.1-1) unstable; urgency=medium

  * New upstream release.

 -- Tristan Seligmann <mithrandi@debian.org>  Sat, 29 Aug 2020 15:51:55 +0200

python-cryptography (3.0-1) unstable; urgency=medium

  * New upstream release.

 -- Tristan Seligmann <mithrandi@debian.org>  Tue, 21 Jul 2020 10:22:33 +0200

python-cryptography (2.9.2-1) unstable; urgency=medium

  * New upstream release (closes: #963114).
    - Drop cherry-picked patches.
  * Switch to dh-sequence-*.
  * Bump debhelper-compat to 13.
  * Apply sphinxdoc:Built-Using.
  * Use local python3-doc inventory.

 -- Tristan Seligmann <mithrandi@debian.org>  Sat, 18 Jul 2020 18:25:40 +0200

python-cryptography (2.8-4) unstable; urgency=medium

  * Drop python2 support; Closes: #937672
  * Add myself to Uploaders (with Maintainer's permission)

 -- Sandro Tosi <morph@debian.org>  Sat, 04 Apr 2020 18:53:59 -0400

python-cryptography (2.8-3) unstable; urgency=medium

  * Team upload.
  * debian/control
    - use python3-sphinx-rtd-theme; Closes: #950448

 -- Sandro Tosi <morph@debian.org>  Sat, 01 Feb 2020 20:01:51 -0500

python-cryptography (2.8-2) unstable; urgency=medium

  * Fix autopkgtest deps (Closes: #950262).
  * Depend on python-all-dev instead of python-dev.
  * Bump Standards-Version to 4.5.0 (no changes).

 -- Tristan Seligmann <mithrandi@debian.org>  Fri, 31 Jan 2020 10:50:12 +0200

python-cryptography (2.8-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Bump debhelper from old 11 to 12.
  * Re-export upstream signing key without extra signatures.
  * Remove obsolete fields Contact, Name from debian/upstream/metadata.

  [ Tristan Seligmann ]
  * New upstream release (Closes: #941261).
  * Bump Standards-Version to 4.4.1 (no changes).
  * Drop upstream patches.
  * Allow rootless builds.

 -- Tristan Seligmann <mithrandi@debian.org>  Wed, 29 Jan 2020 18:22:38 +0200

python-cryptography (2.6.1-4) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.

  [ Moritz Muehlenhoff ]
  * Cherrypick 92241410b5b0591d849443b3023992334a4be0a2 and
    9a22851fab924fd58482fdad3f8dd23dc3987f91 from upstream which
    addresses a memory leak triggerable when parsing x509
    certificate extensions like AIA, thanks to Valentin
    Gutierrez for the report (Closes: #941413)

 -- Moritz Muehlenhoff <jmm@debian.org>  Fri, 18 Oct 2019 14:54:14 +0200

python-cryptography (2.6.1-3.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Backport two patches to fix the testsute with newer openssl.
  * Ignore test_load_ecdsa_no_named_curve in the testsuite because it known to
    break with newer openssl (Closes: #940547).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Tue, 24 Sep 2019 21:10:32 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python-cryptography-doc`.
